https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300204 <H2 id="toc-hId-1673211419" class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Table of contents</H2> <P><LI-TOC indent="15" liststyle="disc" maxheadinglevel="4"></LI-TOC></P> <HR /> <H2 id="toc-hId--878945542" class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Summary</H2> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">This article helps you troubleshoot Kubernetes-specific log collection issues with Log module. It covers no logs appearing, missing or incorrect Kubernetes metadata, and gaps in container logs. It applies to Log Module deployed via OneAgent (Classic or Cloud-Native Full-Stack) or Dynatrace Operator (Kubernetes Log Module), on both SaaS and Managed environments.</P> <H2 id="toc-hId-863864793" class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Problem</H2> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">You see one of the following:</P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">No logs at all from Kubernetes workloads, or no logs from a specific namespace or node.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Logs are visible in the Logs app, but lack Kubernetes metadata such as <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.namespace.name</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.pod.name</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.name</CODE>, or <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.kind</CODE>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Logs are visible in the <STRONG>Logs app</STRONG>, but the <STRONG>Container detail</STRONG> view in the Kubernetes app shows <STRONG>No logs found.</STRONG></LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Pod annotation–based ingest rules are ignored.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Time-series log volume charts show periodic gaps.</LI> </UL> <H3 id="toc-hId--1884805673" class="text-text-100 mt-2 -mb-1 text-base font-bold">Kubernetes metadata attached to Container Output logs</H3> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">For reference, this is the metadata that Log Module attaches automatically to logs ingested as <STRONG>Container Output</STRONG>:</P> <DIV class="overflow-x-auto w-full px-2 mb-6"> <TABLE class="min-w-full border-collapse text-sm leading-[1.7] whitespace-normal"> <THEAD class="text-left"> <TR> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Attribute</TH> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Description</TH> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Notes</TH> </TR> </THEAD> <TBODY> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.container.name</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Container name</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">&nbsp;</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.pod.name</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Pod name</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Numbers preserved</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.deployment.name</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Deployment base name</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Numbers generalized to <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">*</CODE></TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.pod.uid</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Pod UID</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">&nbsp;</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.namespace.name</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Namespace</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">&nbsp;</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.cluster.name</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Cluster display name</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">&nbsp;</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.name</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Exact workload name</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Requires <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> and the <STRONG>Collect all container logs</STRONG> flag</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.kind</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Workload kind</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Requires <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> and the <STRONG>Collect all container logs</STRONG> flag</TD> </TR> <TR> <TD><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.pod.annotation</CODE></TD> <TD>&nbsp;</TD> <TD>Requires <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> and the <STRONG>Collect all container logs</STRONG> flag</TD> </TR> <TR> <TD><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.pod.label</CODE></TD> <TD>&nbsp;</TD> <TD>Requires <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> and the <STRONG>Collect all container logs</STRONG> flag</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">dt.entity.container_group_instance</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Container entity ID</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Full-Stack OneAgent only. Used by the Container screen in the Kubernetes app</TD> </TR> </TBODY> </TABLE> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Key rule:</STRONG> Logs ingested as Container Output (via the container runtime) automatically receive Kubernetes metadata. Logs ingested from file-system paths via a custom log source pointing to <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">/var/log/pods/...</CODE>&nbsp;<SPAN><STRONG>don't</STRONG></SPAN>.</P> <H2 id="toc-hId-54518167" class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Troubleshooting steps</H2> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Before opening a ticket or investigating a specific scenario, verify all items in this checklist.</P> <DIV class="overflow-x-auto w-full px-2 mb-6"> <TABLE class="min-w-full border-collapse text-sm leading-[1.7] whitespace-normal"> <THEAD class="text-left"> <TR> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">#</TH> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Check</TH> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">How to verify</TH> </TR> </THEAD> <TBODY> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">1</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">A log ingest rule exists for the desired logs</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><STRONG>Settings </STRONG>&gt;<STRONG> Collect and capture </STRONG>&gt;<STRONG> Log Monitoring </STRONG>&gt; <STRONG>Log storage configuration</STRONG>. Select the relevant scope at the top left.</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">2</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> is present in the correct DynaKube</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">kubectl get dynakube -n dynatrace -o jsonpath='{range .items[*]}{.metadata.name}{"\n\t.spec.logMonitoring: "}{.spec.logMonitoring}{"\n\t.spec.metadataEnrichment: "}{.spec.metadataEnrichment}{"\n"}{end}'</CODE></TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">3</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.metadataEnrichment.enabled: true</CODE> in the DynaKube</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Same command as above</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">4</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">ActiveGate has the <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">kubernetes-monitoring</CODE> capability</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">kubectl get dynakube -n dynatrace -o jsonpath='{range .items[*]}{.metadata.name}{"\n\t.spec.activeGate.capabilities: "}{.spec.activeGate.capabilities}{"\n"}{end}'</CODE></TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">5</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">No conflicting ingest rules at a higher scope override your include rule</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Check hierarchy and overrides on the Kubernetes cluster scope</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">6</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">No <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">ingest.warning</CODE> attribute on existing log records</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">DQL: <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">fetch logs | filter isNotNull(dt.ingest.warnings)</CODE></TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">7</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Operator DaemonSet pods are running on every node</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">kubectl -n dynatrace get pods -o jsonpath='{range .items[*]}{.metadata.ownerReferences[0].name}{"\t"}{.spec.nodeName}{"\n"}{end}' | grep -E 'logmonitoring|oneagent'</CODE></TD> </TR> </TBODY> </TABLE> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">If the checklist passes, match your symptoms to a scenario below.</P> <H2 id="toc-hId-1797328502" class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">Resolution</H2> <H3>No logs from Kubernetes</H3> <H4 id="toc-hId--951341964" class="text-text-100 mt-2 -mb-1 text-base font-bold">Log storage rule not matching</H4> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Container logs don't appear in Dynatrace, even though the cluster is fully monitored.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">No ingest warning is present on any record because no record exists.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause (brief)</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Log ingestion is a two-step process: source detection (automatic) and log acquisition (requires an explicit ingest rule). A source definition alone is not sufficient. It must match a rule with <STRONG>Include in storage</STRONG> set.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <OL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-decimal flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Go to <STRONG>Settings</STRONG> &gt;<STRONG> Collect and capture </STRONG>&gt;<STRONG> Log Monitoring </STRONG>&gt;<STRONG> Log storage configuration</STRONG>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Select the Kubernetes cluster scope.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Add a rule with <STRONG>Include in storage</STRONG> that matches your target containers, namespaces, or workloads.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Verify rule order: rules execute top-to-bottom; the first match wins. A broad exclusion above your inclusion silently blocks ingestion.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Check the scope hierarchy: <STRONG>Host scope</STRONG> &gt; <STRONG>Kubernetes cluster scope</STRONG> &gt; <STRONG>Host group scope</STRONG> &gt; <STRONG>Environment scope</STRONG>. A more specific scope takes precedence.</LI> </OL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Tip:</STRONG> Add an explicit <STRONG>Exclude all</STRONG>&nbsp;rule at the bottom of the Kubernetes cluster scope to prevent fallthrough to a broad environment-level include rule.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Configuration changes propagate to agents within ~90 seconds.</P> <HR /> <H4 id="toc-hId-791468371" class="text-text-100 mt-2 -mb-1 text-base font-bold"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">PodListFuture not valid</CODE> — missing <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE></H4> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The OneAgent or Kubernetes Log Module pod logs repeatedly show:</LI> </UL> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="Code"> <DIV class="sticky opacity-0 group-hover/copy:opacity-100 group-focus-within/copy:opacity-100 top-2 py-2 h-12 w-0 float-right"> <DIV class="absolute right-0 h-8 px-2 items-center inline-flex z-10">&nbsp;</DIV> </DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5"><CODE><SPAN> [containersdetector] [error] Annotation retrieval failed: PodListFuture not valid (This message was ignored N times.)</SPAN></CODE></PRE> </DIV> </DIV> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Logs from specific namespaces or workloads are absent.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.name</CODE>,&nbsp;<CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.kind</CODE>,&nbsp;<CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.pod.label</CODE>&nbsp;and <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.pod.annotation</CODE>&nbsp;are missing.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause (brief)</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Log Module cannot reach the Kubelet API because the DynaKube is missing <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE>, which grants the required RBAC.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Add <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> and <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.metadataEnrichment</CODE> to the DynaKube that contains <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.oneAgent</CODE>:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="yaml code"> <DIV class="text-text-500 font-small p-3.5 pb-0">yaml</DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5 language-yaml"><CODE>spec: logMonitoring: {} metadataEnrichment: enabled: true</CODE></PRE> </DIV> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">&nbsp;</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Apply the change:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="bash code"> <DIV class="text-text-500 font-small p-3.5 pb-0">bash</DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5 language-bash"><CODE>kubectl apply -f dynakube.yaml</CODE></PRE> </DIV> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">&nbsp;</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">If the error persists after a few minutes, restart the Log Monitoring DaemonSet:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="bash code"> <DIV class="text-text-500 font-small p-3.5 pb-0">bash</DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5 language-bash"><CODE>kubectl rollout restart daemonset -n dynatrace &lt;log-monitoring-daemonset-name&gt;</CODE></PRE> </DIV> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Note for Full-Stack deployments:</STRONG> <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> does not deploy a separate Kubernetes Log Module DaemonSet when <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.oneAgent</CODE> is already defined. It only activates log monitoring inside the existing Full-Stack OneAgent and grants it the RBAC needed to access the local Kubelet API.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">The <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">PodListFuture not valid</CODE> error does not prevent log collection — only metadata enrichment is affected. Records are still ingested, but without <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.*</CODE> attributes, they won't appear in the Kubernetes app or workload-filtered views.</P> <HR /> <H4 id="toc-hId--1760688590" class="text-text-100 mt-2 -mb-1 text-base font-bold"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> in the wrong DynaKube</H4> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">After adding <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> (and <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.templates.logMonitoring</CODE>), log collection does not improve.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">PodListFuture not valid</CODE> error persists.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause (brief)</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> and <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.templates.logMonitoring</CODE> must be in the same DynaKube as <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.oneAgent</CODE>. If you have separate DynaKube objects for the ActiveGate and the OneAgent, placing the log monitoring configuration in the wrong one is silently ignored.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Move <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.logMonitoring</CODE> and <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.templates.logMonitoring</CODE> to the DynaKube that also contains <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">.spec.oneAgent</CODE>.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Example of a correct split-DynaKube configuration:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="yaml code"> <DIV class="sticky opacity-0 group-hover/copy:opacity-100 group-focus-within/copy:opacity-100 top-2 py-2 h-12 w-0 float-right"> <DIV class="absolute right-0 h-8 px-2 items-center inline-flex z-10"> <DIV class="relative"> <DIV class="transition-all opacity-100 scale-100">&nbsp;</DIV> <DIV class="absolute inset-0 flex items-center justify-center"> <DIV class="transition-all opacity-0 scale-50">&nbsp;</DIV> </DIV> </DIV> </DIV> </DIV> <DIV class="text-text-500 font-small p-3.5 pb-0">yaml</DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5 language-yaml"><CODE># DynaKube 1: ActiveGate spec: activeGate: capabilities: - kubernetes-monitoring --- # DynaKube 2: OneAgent + Log Monitoring (BOTH must be here) spec: oneAgent: applicationMonitoring: {} metadataEnrichment: enabled: true logMonitoring: ingestRuleMatchers: - attribute: k8s.namespace.name values: - production - staging</CODE></PRE> </DIV> </DIV> <HR /> <H4 id="toc-hId-1009770791" class="text-text-100 mt-2 -mb-1 text-base font-bold">Init container permission failure on SELinux / OpenShift</H4> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The Log Monitoring DaemonSet fails to start.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The init container (bootstrapper) can't access the required host paths and exits with a permission error.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The DaemonSet ends up in <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">Init:Error</CODE> or <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">CrashLoopBackOff</CODE>.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">SELinux blocks the bootstrapper from accessing host paths required for Log Module setup. Most commonly seen on OpenShift, but applies to any environment with SELinux enforcement.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Add the <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">feature.dynatrace.com/oneagent-privileged: "true"</CODE> annotation to the DynaKube manifest:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="yaml code"> <DIV class="text-text-500 font-small p-3.5 pb-0">yaml</DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5 language-yaml"><CODE>apiVersion: dynatrace.com/v1beta3 kind: DynaKube metadata: name: &lt;your-dynakube&gt; namespace: dynatrace annotations: feature.dynatrace.com/oneagent-privileged: "true" spec: ...</CODE></PRE> </DIV> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">&nbsp;</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Restart the DaemonSet:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="bash code"> <DIV class="text-text-500 font-small p-3.5 pb-0">bash</DIV> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5 language-bash"><CODE>kubectl rollout restart daemonset -n dynatrace &lt;log-monitoring-daemonset-name&gt;</CODE></PRE> </DIV> </DIV> <HR /> <H3 class="text-text-100 mt-2 -mb-1 text-base font-bold"><STRONG>Logs visible but missing data or metadata</STRONG></H3> <H4 id="toc-hId--1542386170" class="text-text-100 mt-2 -mb-1 text-base font-bold">Specific namespaces not ingested</H4> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Some namespaces produce logs visible in Dynatrace; others do not, despite identical configuration.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Work through the common causes in order:</P> <DIV class="overflow-x-auto w-full px-2 mb-6"> <TABLE class="min-w-full border-collapse text-sm leading-[1.7] whitespace-normal"> <THEAD class="text-left"> <TR> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Cause</TH> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Fix</TH> </TR> </THEAD> <TBODY> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">No ingest rule for those namespaces</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Add a <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.namespace.name</CODE> matcher to the ingest rule</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">OneAgent is not running on the nodes hosting affected pods</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Confirm the OneAgent DaemonSet has pods on every affected node</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Custom log source conflict on <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">/var/log/pods</CODE></TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Remove the custom source — see <A class="underline underline underline-offset-2 decoration-1 decoration-current/40 hover:decoration-current focus:decoration-current" href="https://community.dynatrace.com/t5/Archive-TKB/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300152#custom-log-source-blocks-kubernetes-enrichment" target="_blank" rel="nofollow noopener noreferrer">Custom log source blocks Kubernetes enrichment</A></TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Higher-priority scope has an exclude override</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Check host, host-group, and environment scopes for conflicting rules</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">The <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">dynatrace</CODE> namespace is missing</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">The <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">dynatrace</CODE> namespace is excluded by default. Enable <STRONG>Allow OneAgent to monitor Dynatrace logs</STRONG> under <STRONG>Settings → Collect and capture → Log Monitoring → Advanced log settings</STRONG></TD> </TR> </TBODY> </TABLE> </DIV> <HR /> <H4 id="toc-hId-200424165" class="text-text-100 mt-2 -mb-1 text-base font-bold">Container screen shows "No logs found"</H4> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Logs are accessible at the workload, namespace, or pod level in the Kubernetes app.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The Container detail view shows "No logs found."</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Container-level log display requires the <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">dt.entity.container_group_instance</CODE> attribute. This attribute is only added by the Full-Stack OneAgent. It is <STRONG>not</STRONG> added by the Kubernetes Log module or by App-Only deployments.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">This is by design for App-Only and Kubernetes Log module deployments. Logs remain queryable via the Logs viewer using <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.container.name</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.pod.name</CODE>, etc.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">If container-level display in the Kubernetes app is required, deploy Full-Stack OneAgent on the affected nodes.</P> <HR /> <H4 id="toc-hId-1943234500" class="text-text-100 mt-2 -mb-1 text-base font-bold">Custom log source blocks Kubernetes enrichment</H4> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Kubernetes metadata (pod name, namespace, deployment name) is missing from logs, even though the cluster is fully monitored.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Custom log source rules targeting <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">/var/log/pods/</CODE> or <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">/var/log/containers/</CODE> are present in the configuration.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">A custom log source matching Kubernetes container log directories bypasses the automatic container log detection pipeline. Log Module treats those files as plain host-level logs and does not attach <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.*</CODE> metadata.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Remove the custom log source rules that target <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">/var/log/pods/</CODE> or <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">/var/log/containers/</CODE>, then use ingest rules with Kubernetes matchers (such as <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.namespace.name</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.pod.annotation</CODE>, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.name</CODE>) to control what gets ingested.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">For step-by-step resolution, see <EM>Troubleshooting missing logs → Custom log source blocks Kubernetes enrichment</EM>.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Warning:</STRONG> After removing path-based custom log sources, logs may stop appearing entirely if no matching ingest rule exists. Ensure an ingest rule covers Container Output before removing the custom source.</P> <HR /> <H4 id="toc-hId--608922461" class="text-text-100 mt-2 -mb-1 text-base font-bold"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.deployment.name</CODE> shows wildcards (<CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">*</CODE>)</H4> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Filtering by <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.deployment.name</CODE> fails because numeric parts are replaced with <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">*</CODE> (for example, <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">pricing-service-v24</CODE> becomes <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">pricing-service-v*</CODE>).</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.deployment.name</CODE> is the base pod name with numeric suffixes generalized. This is by design, it groups all replica pods under a single entity, consistent with how Dynatrace entity modeling works.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Workarounds</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Use <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.pod.name</CODE> (numeric suffixes are always preserved):</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="Code"> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5"><CODE><SPAN>fetch logs </SPAN><SPAN>| filter startsWith(k8s.pod.name, "pricing-service-v24")</SPAN></CODE></PRE> </DIV> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">&nbsp;</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Or upgrade to OneAgent ≥ 1.307 and Dynatrace Operator ≥ 1.4.1 and use <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">k8s.workload.name</CODE>, which contains the exact workload name without generalization:</P> <DIV class="relative group/copy bg-bg-000/50 border-0.5 border-border-400 rounded-lg focus:outline-none focus-visible:ring-2 focus-visible:ring-accent-100" tabindex="0" role="group" aria-label="Code"> <DIV class="overflow-x-auto"> <PRE class="code-block__code !my-0 !rounded-lg !text-sm !leading-relaxed p-3.5"><CODE><SPAN>fetch logs </SPAN><SPAN>| filter k8s.workload.name == "pricing-service-v24"</SPAN></CODE></PRE> </DIV> </DIV> <HR /> <H4 id="toc-hId--1418269087" class="text-text-100 mt-2 -mb-1 text-base font-bold">Pod annotation–based rules ignored — <CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">Collect all container logs</CODE> toggle</H4> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Pod annotation–based log ingestion rules are ignored. Logs from annotated pods are not ingested.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Whether the <STRONG>Collect all container logs</STRONG> toggle is required depends on the deployment type.</P> <DIV class="overflow-x-auto w-full px-2 mb-6"> <TABLE class="min-w-full border-collapse text-sm leading-[1.7] whitespace-normal"> <THEAD class="text-left"> <TR> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Deployment</TH> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Toggle required?</TH> <TH class="text-text-100 border-b-0.5 border-border-300/60 py-2 pr-4 align-top font-bold" scope="col">Min version</TH> </TR> </THEAD> <TBODY> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">OneAgent DaemonSet (Classic / Cloud-Native Full-Stack)</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Yes</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">OneAgent 1.309, Operator 1.4.2</TD> </TR> <TR> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">Kubernetes Log Module (<CODE class="bg-text-200/5 border border-0.5 border-border-300 text-danger-000 whitespace-pre-wrap rounded-[0.4rem] px-1 py-px text-[0.9rem]">spec.logMonitoring</CODE> only)</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">No</TD> <TD class="border-b-0.5 border-border-300/30 py-2 pr-4 align-top">OneAgent 1.309, Operator 1.4.2</TD> </TR> </TBODY> </TABLE> </DIV> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution (OneAgent DaemonSet only)</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Turn on&nbsp;<STRONG>Settings </STRONG>&gt;<STRONG> Collect and capture </STRONG>&gt; <STRONG>Log Monitoring </STRONG>&gt;<STRONG> Log module feature flags</STRONG> &gt;<STRONG> Collect all container logs</STRONG> at the Kubernetes cluster scope.</P> <HR /> <H3 class="text-text-100 mt-2 -mb-1 text-base font-bold"><STRONG>Log gaps and inconsistencies</STRONG></H3> <H4 id="toc-hId-324541248" class="text-text-100 mt-2 -mb-1 text-base font-bold">Log Module at performance limits</H4> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Symptoms</STRONG></P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">Periodic gaps in log volume are visible as drops in time-series charts.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">High-throughput pods show intermittently missing logs.</LI> </UL> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Cause</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Log Module processes data in 60-second intervals with configurable throughput limits. When log volume exceeds the default limits, the agent falls behind, and gaps appear.</P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]"><STRONG>Resolution</STRONG></P> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Processing and upload limits are adjustable per environment and are handled individually by Support. Open a support ticket with:</P> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The affected cluster and namespaces.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">The approximate log volume from the affected pods.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">A screenshot of the volume gap in the time-series chart.</LI> </UL> <HR /> <P class="font-claude-response-body break-words whitespace-normal leading-[1.7]">&nbsp;</P> <H2 id="toc-hId-999267687" class="text-text-100 mt-3 -mb-1 text-[1.125rem] font-bold">What's next</H2> <UL class="[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3"> <LI class="font-claude-response-body whitespace-normal break-words pl-2">For boundary issues (multi-line entries split incorrectly, entries merged), see <EM>Troubleshooting log record boundary detection</EM>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">For broader "missing logs" troubleshooting beyond Kubernetes, see <EM>Troubleshooting missing logs</EM>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">For ingest delay (logs arrive but late), see <EM>Troubleshooting log ingest delay</EM>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">For JSON parsing issues (wrong timestamp from JSON field, severity mapping), see <EM>Troubleshooting JSON log parsing</EM>.</LI> <LI class="font-claude-response-body whitespace-normal break-words pl-2">For log rotation issues (gaps at rotation boundaries, missing rotated files), see <EM>Troubleshooting log rotation issues with Log Module</EM>.</LI> </UL> Wed, 26 Aug 2026 08:32:21 GMT Kacper 2026-08-26T08:32:21Z https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300204 <P><LI-TOC indent="15" liststyle="disc" maxheadinglevel="2"></LI-TOC></P> <DIV class="lia-message-template-content-zone"> <P>*<EM>Use a table of contents for longer articles.&nbsp;</EM></P> <H1>Summary</H1> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Short description of which part of the Dynatrace platform the article refers to and what kind of problem it will help resolve / task it will describe.</EM></P> <P>&nbsp;</P> <H1>Problem</H1> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Provide a precise description of the problem / task to be described.</EM></P> <P>&nbsp;</P> <H1>Troubleshooting steps</H1> <P><EM>*This section can be omitted.</EM></P> <P>&nbsp;</P> <H1>Resolution</H1> <P><EM>*This section can be omitted for ticket‑creation articles.</EM></P> <H1>What's next</H1> <P><EM>*This is a mandatory section.</EM></P> </DIV> Wed, 26 Aug 2026 08:32:21 GMT https://community.dynatrace.com/t5/Troubleshooting/Troubleshooting-Kubernetes-logs-in-Log-module/ta-p/300204 Kacper 2026-08-26T08:32:21Z